A critical Active Storage vulnerability allows arbitrary file read and possible remote code execution through libvips variant processing. Here's what to check and how to patch.
Rails disclosed CVE-2026-66066 this week: a possible arbitrary file read and remote code execution in Active Storage variant processing. If your app accepts image uploads and uses libvips, stop reading and go patch.
Am I Affected?
You're affected if both of these are true:
Your app uses libvips for Active Storage (config.active_storage.variant_processor = :vips)
Untrusted users can upload images that get variants generated
A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a…
The vulnerability abuses Active Storage, allowing unauthenticated attackers to read sensitive files and potentially take over…
CVE-2026-66066 could expose Rails server files through image uploads, leaking secrets that may enable RCE or lateral movement.
KindaRails2Shell (CVE-2026-66066): Arbitrary File Read and RCE via Active Storage...
Through compromised images, attackers can read out server environment variables, including secrets, and thus open further doors…
Ruby on Rails has patched CVE-2026-66066, a critical vulnerability leading to unauthenticated file reads and potentially RCE.
